======================================
| xx__-> [    8.503345][  T191] ==================================================================
| [    8.503486][  T191] BUG: KASAN: slab-use-after-free in neigh_dump_info (net/core/neighbour.c:2950 (discriminator 1))
| [    8.503600][  T191] Read of size 1 at addr ff1100000203fbd0 by task netlink-dumps/191
| [    8.503707][  T191]
[    8.503752][  T191] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    8.503754][  T191] Call Trace:
[    8.503755][  T191]  <TASK>
[    8.503756][  T191]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[    8.503762][  T191]  print_address_description.constprop.0 (mm/kasan/report.c:378)
[    8.503767][  T191]  print_report (mm/kasan/report.c:482)
[    8.503769][  T191]  ? __virt_addr_valid (./include/linux/rcupdate.h:937 ./include/linux/mmzone.h:2281 arch/x86/mm/physaddr.c:54)
[    8.503773][  T191]  ? __virt_addr_valid (./include/linux/rcupdate.h:963 (discriminator 1) ./include/linux/mmzone.h:2291 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))
[    8.503775][  T191]  kasan_report (mm/kasan/report.c:595)
[    8.503778][  T191]  ? neigh_dump_info (net/core/neighbour.c:2950 (discriminator 1))
[    8.503781][  T191]  ? neigh_dump_info (net/core/neighbour.c:2950 (discriminator 1))
[    8.503783][  T191]  neigh_dump_info (net/core/neighbour.c:2950 (discriminator 1))
[    8.503785][  T191]  ? __alloc_skb (./include/linux/instrumented.h:97 ./include/linux/atomic/atomic-instrumented.h:67 net/core/skbuff.c:408 net/core/skbuff.c:720)
[    8.503788][  T191]  ? __alloc_skb (./include/linux/bottom_half.h:20 (discriminator 2) net/core/skbuff.c:695 (discriminator 2))
[    8.503789][  T191]  ? neigh_proc_base_reachable_time (net/core/neighbour.c:3745)
[    8.503792][  T191]  netlink_dump (net/netlink/af_netlink.c:2326)
[    8.503796][  T191]  ? netlink_lookup (./include/linux/refcount.h:291)
[    8.503799][  T191]  ? kmem_cache_free (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6250 mm/slub.c:6377)
[    8.503802][  T191]  netlink_recvmsg (net/netlink/af_netlink.c:1977)
[    8.503804][  T191]  ? netlink_dump (net/netlink/af_netlink.c:2239 (discriminator 1))
[    8.503807][  T191]  __sys_recvfrom (net/socket.c:1137 (discriminator 4) net/socket.c:1159 (discriminator 4) net/socket.c:2315 (discriminator 4))
[    8.503810][  T191]  ? __ia32_sys_send (net/socket.c:2279)
[    8.503814][  T191]  ? exc_page_fault (arch/x86/mm/fault.c:1474 arch/x86/mm/fault.c:1527)
[    8.503818][  T191]  __x64_sys_recvfrom (net/socket.c:2330 net/socket.c:2326 net/socket.c:2326)
[    8.503819][  T191]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[    8.503823][  T191]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[    8.503824][  T191]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[    8.503826][  T191]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[    8.503828][  T191]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[    8.503830][  T191]  ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3))
[    8.503831][  T191]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[    8.503833][  T191] RIP: 0033:0x7f4100be408e
[    8.503836][  T191] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 94 bd 00 00       	call   0xbd9c
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[    8.503838][  T191] RSP: 002b:00007ffef541ec10 EFLAGS: 00000202 ORIG_RAX: 000000000000002d
[    8.503841][  T191] RAX: ffffffffffffffda RBX: 00000000004062c0 RCX: 00007f4100be408e
[    8.503843][  T191] RDX: 0000000000002000 RSI: 00007ffef541ec80 RDI: 0000000000000005
[    8.503844][  T191] RBP: 00007ffef541ec20 R08: 0000000000000000 R09: 0000000000000000
[    8.503845][  T191] R10: 0000000000000040 R11: 0000000000000202 R12: 0000000000000005
[    8.503845][  T191] R13: 0000000000000018 R14: 000000000000001c R15: 0000000000000003
| [    8.513161][  T191] refcount_t: underflow; use-after-free.
| [    8.513247][  T191] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x99/0xc0, CPU#1: netlink-dumps/191
| [    8.513403][  T191] Modules linked in:
| [    8.513627][  T191] Tainted: [B]=BAD_PAGE
[    8.513682][  T191] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[    8.513771][  T191] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 6))
[    8.513865][  T191] Code: b9 3a 5b 5d c3 48 8d 3d 35 ba 50 03 67 48 0f b9 3a 5b 5d c3 48 8d 3d 36 ba 50 03 67 48 0f b9 3a 5b 5d c3 48 8d 3d 37 ba 50 03 <67> 48 0f b9 3a 5b 5d c3 48 8d 3d 38 ba 50 03 67 48 0f b9 3a 5b 5d
All code
========
   0:	b9 3a 5b 5d c3       	mov    $0xc35d5b3a,%ecx
   5:	48 8d 3d 35 ba 50 03 	lea    0x350ba35(%rip),%rdi        # 0x350ba41
   c:	67 48 0f b9 3a       	ud1    (%edx),%rdi
  11:	5b                   	pop    %rbx
  12:	5d                   	pop    %rbp
  13:	c3                   	ret
  14:	48 8d 3d 36 ba 50 03 	lea    0x350ba36(%rip),%rdi        # 0x350ba51
  1b:	67 48 0f b9 3a       	ud1    (%edx),%rdi
  20:	5b                   	pop    %rbx
  21:	5d                   	pop    %rbp
  22:	c3                   	ret
  23:	48 8d 3d 37 ba 50 03 	lea    0x350ba37(%rip),%rdi        # 0x350ba61
  2a:*	67 48 0f b9 3a       	ud1    (%edx),%rdi		<-- trapping instruction
  2f:	5b                   	pop    %rbx
  30:	5d                   	pop    %rbp
  31:	c3                   	ret
  32:	48 8d 3d 38 ba 50 03 	lea    0x350ba38(%rip),%rdi        # 0x350ba71
  39:	67 48 0f b9 3a       	ud1    (%edx),%rdi
  3e:	5b                   	pop    %rbx
  3f:	5d                   	pop    %rbp

Code starting with the faulting instruction
===========================================
   0:	67 48 0f b9 3a       	ud1    (%edx),%rdi
   5:	5b                   	pop    %rbx
   6:	5d                   	pop    %rbp
   7:	c3                   	ret
   8:	48 8d 3d 38 ba 50 03 	lea    0x350ba38(%rip),%rdi        # 0x350ba47
   f:	67 48 0f b9 3a       	ud1    (%edx),%rdi
  14:	5b                   	pop    %rbx
  15:	5d                   	pop    %rbp
[    8.514125][  T191] RSP: 0018:ffa00000008b7a80 EFLAGS: 00010246
[    8.514215][  T191] RAX: 0000000000000000 RBX: ff1100000d88bedc RCX: ffffffffa15fec28
[    8.514322][  T191] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffffa4b0a640
[    8.514436][  T191] RBP: 0000000000000003 R08: ffffffffa15feb85 R09: 1fe2200001b117db
[    8.514544][  T191] R10: 0000000000000007 R11: ffe21c0001b117dc R12: 0000000000000000
[    8.514649][  T191] R13: ff11000002998800 R14: ff1100000bcf4eb4 R15: ff1100000bcf4e40
[    8.514758][  T191] FS:  00007f4100b71740(0000) GS:ff110000bfb45000(0000) knlGS:0000000000000000
[    8.514886][  T191] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.514983][  T191] CR2: 00007f4100b77a00 CR3: 000000000ffef002 CR4: 0000000000771ef0
[    8.515090][  T191] PKRU: 55555554
[    8.515144][  T191] Call Trace:
[    8.515199][  T191]  <TASK>
[    8.515236][  T191]  netlink_dump (net/netlink/af_netlink.c:2378)
[    8.515309][  T191]  ? netlink_lookup (./include/linux/refcount.h:291)
[    8.515385][  T191]  ? kmem_cache_free (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6250 mm/slub.c:6377)
[    8.515457][  T191]  netlink_recvmsg (net/netlink/af_netlink.c:1977)
[    8.515529][  T191]  ? netlink_dump (net/netlink/af_netlink.c:2239 (discriminator 1))
[    8.515601][  T191]  __sys_recvfrom (net/socket.c:1137 (discriminator 4) net/socket.c:1159 (discriminator 4) net/socket.c:2315 (discriminator 4))
[    8.515672][  T191]  ? __ia32_sys_send (net/socket.c:2279)
[    8.515744][  T191]  ? exc_page_fault (arch/x86/mm/fault.c:1474 arch/x86/mm/fault.c:1527)
[    8.515815][  T191]  __x64_sys_recvfrom (net/socket.c:2330 net/socket.c:2326 net/socket.c:2326)
[    8.515886][  T191]  ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 22))
[    8.515980][  T191]  ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4472)
[    8.516088][  T191]  ? do_syscall_64 (./include/linux/entry-common.h:177 arch/x86/entry/syscall_64.c:89)
[    8.516159][  T191]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[    8.516230][  T191]  ? trace_hardirqs_off (kernel/trace/trace_preemptirq.c:104 (discriminator 1))
[    8.516301][  T191]  ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3))
[    8.516417][  T191]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[    8.516504][  T191] RIP: 0033:0x7f4100be408e
[    8.516579][  T191] Code: 4d 89 d8 e8 94 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
All code
========
   0:	4d 89 d8             	mov    %r11,%r8
   3:	e8 94 bd 00 00       	call   0xbd9c
   8:	4c 8b 5d f8          	mov    -0x8(%rbp),%r11
   c:	41 8b 93 08 03 00 00 	mov    0x308(%r11),%edx
  13:	59                   	pop    %rcx
  14:	5e                   	pop    %rsi
  15:	48 83 f8 fc          	cmp    $0xfffffffffffffffc,%rax
  19:	74 11                	je     0x2c
  1b:	c9                   	leave
  1c:	c3                   	ret
  1d:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
  24:	48 8b 45 10          	mov    0x10(%rbp),%rax
  28:	0f 05                	syscall
  2a:*	c9                   	leave		<-- trapping instruction
  2b:	c3                   	ret
  2c:	83 e2 39             	and    $0x39,%edx
  2f:	83 fa 08             	cmp    $0x8,%edx
  32:	75 e7                	jne    0x1b
  34:	e8 03 ff ff ff       	call   0xffffffffffffff3c
  39:	0f 1f 00             	nopl   (%rax)
  3c:	f3 0f 1e fa          	endbr64

Code starting with the faulting instruction
===========================================
   0:	c9                   	leave
   1:	c3                   	ret
   2:	83 e2 39             	and    $0x39,%edx
   5:	83 fa 08             	cmp    $0x8,%edx
   8:	75 e7                	jne    0xfffffffffffffff1
   a:	e8 03 ff ff ff       	call   0xffffffffffffff12
   f:	0f 1f 00             	nopl   (%rax)
  12:	f3 0f 1e fa          	endbr64
[    8.516865][  T191] RSP: 002b:00007ffef541ec10 EFLAGS: 00000202 ORIG_RAX: 000000000000002d
[    8.516974][  T191] RAX: ffffffffffffffda RBX: 00000000004062c0 RCX: 00007f4100be408e
[    8.517117][  T191] RDX: 0000000000002000 RSI: 00007ffef541ec80 RDI: 0000000000000005
[    8.517225][  T191] RBP: 00007ffef541ec20 R08: 0000000000000000 R09: 0000000000000000
[    8.517331][  T191] R10: 0000000000000040 R11: 0000000000000202 R12: 0000000000000005


Finger prints:
refcount_warn_saturate:netlink_dump:netlink_recvmsg:__sys_recvfrom:__x64_sys_recvfrom
print_report:kasan_report:neigh_dump_info:netlink_dump:netlink_recvmsg